Reddit’s £14.47m ICO fine — what UK businesses need to do as child protection enforcement ramps up

On 24 February 2026, the UK Information Commissioner’s Office (ICO) fined Reddit — a major US‑based social news and discussion platform — £14.47m for unlawfully processing the personal data of under‑13s and failing to implement effective age verification measures. It’s the ICO’s largest children’s‑privacy‑related penalty to date and comes as the regulator steps up its scrutiny of how online platforms handle young users’ data.

Children’s privacy has become one of the ICO’s most active enforcement priorities and the Reddit decision marks a notable escalation in expectations for businesses operating online. Here, data protection specialists Sara Ludlam and Laura Keane break down what the ICO found and outline three key steps that UK businesses should take now. 

Findings from the ICO investigation

Although Reddit’s terms of service expressly prohibited use of its service by children under the age of 13, this wasn’t sufficient protection according to the ICO. Reddit was held to be in breach of its UK GDPR obligations for failing to implement any effective age verification measures on its platform prior to July 2025. The ICO investigation found a “large number” of under‑13s had been able to access the service without any checks, resulting in unlawful processing of their personal data. 

The investigation also concluded that Reddit hadn't carried out a mandatory data protection impact assessment (DPIA) prior to January 2025, despite processing special category data. This omission meant that Reddit hadn’t evaluated or mitigated the risks that their platform posed to young users, leaving them potentially exposed to inappropriate or harmful content. 

UK Information Commissioner John Edwards described the failings as “unacceptable”, emphasising that children were placed at risk because their personal data was processed in ways that they couldn’t reasonably understand or control. He reiterated that online services must be able to verify the age of their users and that relying on self‑declaration alone is “not enough when children may be at risk”. 

Reddit’s response 

Reddit introduced new age verification mechanisms in July 2025, including age checks for accessing mature content and prompts requiring users to declare their age when creating an account. However, the ICO concluded that these measures remained inadequate, as self‑declaration can be easily bypassed. Reddit has since confirmed that it intends to appeal the decision, arguing that the ICO’s expectations would require the platform to collect more personal data than it believes is appropriate for user privacy. 

Increasing ICO enforcement

The ICO’s fine against Reddit forms part of a growing pattern of regulatory action addressing children’s privacy in the UK. On 5 February 2026, the ICO fined MediaLab.AI, Inc. — owner of the image-hosting platform Imgur — £247,590 for failures in how it handled young users’ personal data. This included processing the data of children under 13 without parental consent or any other lawful basis. The investigation revealed similar issues relating to insufficient age verification and risk assessment obligations, ultimately leading Imgur to block UK access and withdraw from the UK market. 

TikTok has also been a major focus of ICO scrutiny. In April 2023, it was fined £12.7m following concerns that data from under-13s was being used to inform algorithmic systems that could expose young users to inappropriate or harmful content. The ICO has since confirmed that it is continuing to examine how social media and video-sharing platforms use children’s data to optimise algorithms and shape wider data processing activities, as part of a broader programme targeting services that rely heavily on data from young users.

The ICO has also confirmed that it is actively investigating other online platforms, including Discord, Pinterest and X (formerly Twitter). In parallel, the regulator has opened discussions with Meta and Snapchat over concerns about the processing of children’s location data. This escalation in scrutiny demonstrates that age verification and the protection of children online have become priority enforcement areas for the ICO. 

What UK businesses need to do — three key steps

The ICO’s action comes amid broader regulatory efforts to strengthen protections for children online, particularly following the implementation of the UK’s Online Safety Act. The regulator’s messaging has been consistent: businesses offering online services likely to be accessed by children must ensure that their platforms are designed with children’s safety and data protection at the forefront. 

The Reddit enforcement action reinforces several critical compliance points for businesses:

1. Age verification must be robust — self‑declaration alone is insufficient, particularly where the service is likely to attract under-18s.
2. DPIAs are essential — these are required in high‑risk contexts where special category data is being shared and processed.
3. Children’s data requires heightened protection — businesses must proactively identify risks and implement controls to prevent children from being exposed to inappropriate content or unlawful data processing.

Talk to us 

The £14.47m fine imposed on Reddit marks a significant moment in the UK’s data protection landscape, signalling increasingly substantial regulatory and operational consequences for businesses that fall short.

If you need support with carrying out a DPIA, general advice on data protection, UK GDPR, EU GDPR compliance or understanding your obligations, our specialist data protection team is here to guide you through every step of the journey.

Talk to us by giving us a call on 0333 004 4488, sending us an email at hello@brabners.com or completing our contact form below.